Family Educational Rights and Privacy Act (FERPA) Policy

Policy Statement

SUNY Brockport complies with the Family Educational Rights and Privacy Act (FERPA), a federal law that protects the privacy of student education records. Under FERPA, students have the right to inspect and request amendments to their records, control most disclosures of personally identifiable information, and file complaints with the U.S. Department of Education.

The University may release directory information—such as name, major, and dates of attendance—unless a student submits a written request to withhold it. Disclosures without consent are permitted only under specific FERPA exceptions, such as to school officials with legitimate educational interests. Students are notified annually of their FERPA rights through official University publications and communications.

Purpose/Scope

The purpose of this policy is to inform the campus community about the FERPA policy and processes in place. This policy outlines the rights of students regarding access to and control over their educational records, the responsibilities of university personnel in safeguarding those records, and the conditions under which information may be disclosed. It applies to all students, faculty, staff, and third parties who handle or access education records maintained by the University. The policy governs all education records in any format—paper, electronic, or otherwise—that are directly related to students and maintained by the institution or its agents.

Applicability

This policy applies to all members of SUNY Brockport, including faculty, staff, administrators, student employees, and third-party service providers who access, manage, or maintain student education records. It also informs students of their rights under FERPA and outlines the responsibilities of university personnel in protecting the confidentiality and integrity of those records. Compliance with this policy is mandatory for anyone who handles education records in any format.

Definitions

Directory Information — This refers to information contained in a student’s education record that would not generally be considered harmful or an invasion of privacy if disclosed. Under FERPA, SUNY Brockport may disclose directory information without prior written consent unless the student has formally requested to restrict its release. The University has designated the following as directory information:

• student’s name
• current address
• telephone number
• email address
• major field of study
• dates of attendance
• degrees and awards received
• participation in officially recognized activities and sports, and photographs

Per FERPA regulations, SUNY Brockport may disclose directory information to any member of the public without the student’s written consent. Students who wish to withhold directory information must submit a written request to the Office of Registration and Records. Once a restriction is in place, the University will not release any directory information without the student’s written consent.

Education Records — Education records are records that are directly related to a student and maintained by SUNY Brockport or by a party acting on behalf of the University. These records may exist in any format, including handwritten, printed, digital, audio, or video. Examples include transcripts, class schedules, grades, disciplinary records, financial aid documents, and advising notes. Education records do not include:

• personal notes kept by a faculty or staff member that are not shared with others (sole possession records),
• law enforcement records maintained solely for law enforcement purposes,
• employment records when employment is not contingent on student status,
• medical and psychological treatment records maintained by health professionals, or
• alumni records that do not relate to the individual as a student.

Legitimate Educational Interest — This exists when a school official requires access to a student’s education record in order to fulfill their professional responsibilities for SUNY Brockport. This includes tasks related to teaching, advising, counseling, student services, administrative support, research, or maintaining the safety and security of the campus. Access must be necessary to carry out duties that are directly related to the student’s academic progress, discipline, or provision of services. Access for personal interest or curiosity is strictly prohibited and considered a violation of FERPA.

Personally Identifiable Information (PII) — PII refers to any data or combination of data that can be used to identify a student, either directly or indirectly. Under FERPA, PII includes, but is not limited to:

• academic records (grades, GPA, class schedule, transcripts, academic history, academic standing),
• disciplinary records,
• financial aid records,
• medical or health treatment records,
• mental health or counseling records,
• personal identifiers (Social Security number, student ID number, or biometric records), and
• indirect identifiers (date of birth, place of birth, or mother’s maiden name).

PII also includes any information that, alone or in combination, would allow a reasonable person in the University community to identify the student with reasonable certainty. Disclosure of PII without the student’s written consent is prohibited unless an exception under FERPA applies. Exceptions under FERPA to disclose PII without the student’s written consent can be found in the Policy Procedures section.

School Official — A school official is any individual employed by SUNY Brockport in an administrative, supervisory, academic, research, or support staff position, including public safety and health services personnel. This definition also includes individuals or organizations with whom the University has contracted to perform institutional services or functions (such as attorneys, auditors, or service providers), members of the SUNY Board of Trustees, and students serving on official committees or assisting other school officials in performing their tasks. A school official has a legitimate educational interest if they need to review an education record to fulfill their professional responsibilities for the University.

Sole Possession Records — Sole possession records are personal notes created by a school official for their own use/reference. These records are stored privately in a manner that makes them inaccessible to others. Sole possession records are never shared with another school official, agency, or organization. As such, they are not considered educational records. Any note that is created in cooperation with another person or put in a location accessible to others (including in a shared electronic environment) is not a sole possession record and is considered an educational record that the student has a right to inspect.

Student — For the purposes of this policy, a student is defined as any individual who is attending or has attended SUNY Brockport and for whom the University maintains education records. This includes individuals enrolled in credit-bearing courses, regardless of age or status (e.g., full-time, part-time, online, or in-person). FERPA rights begin on the first day of class attendance or participation in an academic activity and continue even after the student has graduated or otherwise left the institution. Applicants who have not yet enrolled or individuals who were denied admission are not considered students under FERPA.

Policy Procedures

SUNY Brockport complies with the Family Educational Rights and Privacy Act (FERPA) by protecting the confidentiality of student education records and ensuring students’ rights to access and control their information.

1. Student Rights — Students are notified annually of their FERPA rights through the Student Handbook and University communications. These rights include:

• • inspecting and reviewing their education records,
  • requesting corrections to inaccurate or misleading records,
  • controlling the disclosure of personally identifiable information (PII), and
  • filing a complaint with the U.S. Department of Education.

2. Access to Records — Students may request to view their records by submitting a written request to the Office of Registration and Records. The University must comply with a request for access to records within a reasonable period of time, but no more than 45 days after the request has been received. If a student believes a record is inaccurate, they may request an amendment and, if denied, request a formal hearing.

3. Education Records — Education records include any records maintained by the University that are directly related to a student. Examples include:

• • academic records (grades, transcripts, enrollment),
  • financial aid and billing records,
  • disciplinary records,
  • housing and contact information, and
  • email and digital records maintained by the University.

Records not covered by FERPA include:

• • sole possession records,
  • law enforcement records,
  • employment records (unless tied to student status), and
  • alumni records created after graduation.

4. Disclosure Without Consent — PII from education records is not shared without written consent, except under specific FERPA exceptions, such as:

• • school officials with a legitimate educational interest,
  • transfer institutions where the student is enrolling,
  • financial aid processing and enforcement,
  • parents of dependent students (as defined by the IRS),
  • health or safety emergencies,
  • court orders or subpoenas (with prior notice unless prohibited),
  • accrediting agencies and government auditors,
  • victims of certain disciplinary incidents, or
  • directory information (unless the student has opted out).

5. Directory Information — SUNY Brockport may release directory information (e.g., name, major, dates of attendance), unless the student submits a Directory Information Opt-Out Form to the Registrar. The Directory Information Opt-Out Form is an internal form in the Office of Registration and Records, which can be obtained by students upon providing identification.
6. Requests from Families of Deceased Students — FERPA rights end upon a student’s death. However, SUNY Brockport may release the education records of deceased students at its discretion. Family members must submit a written request to the Office of the Registrar, including:

• • their relationship to the student,
  • the specific records requested,
  • the reason for the request, and
  • supporting documentation (e.g., death certificate, obituary or letters testamentary or letters of administration).

Requests are reviewed on a case-by-case basis, with consideration for privacy and legal obligations.

7. Training and Confidentiality — All employees with access to education records are to complete FERPA training. Student employees must also sign a confidentiality agreement.

8. Third-Party Access — Vendors and contractors with access to student records must sign data protection agreements to ensure FERPA compliance. These are managed by the Office of Procurement and Payment Services in consultation with SUNY Legal Affairs.

Links to Related Procedures and Information

AACRAO (American Association of Collegiate Registrars and Admissions Officers) - FERPA

SUNY FERPA Policy

U.S Department of Education - Protecting Student Privacy

Contact Information

Office of Registration and Records

University Registrar – FERPA Compliance Officer

History (in descending order)

Item	Date	Explanation
Next Review Date	2031-02-25	Five-year review
Revision Date	2026-02-25	Policy revised throughout
Adoption Date	2015-08-13	Policy Adopted

Approval

This policy was approved by President’s Cabinet on 2026-02-25